Blitar Tourism Authentication Bypass Vulnerability Allowing SQL Injection

An authentication bypass vulnerability has been identified in Blitar Tourism version 1.0. This vulnerability allows attackers to bypass the login mechanism by injecting SQL code through the username parameter. By manipulating the login request with crafted usernames that exploit SQL injection techniques, attackers can gain unauthorized administrative access.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to gain unauthorized administrative access to the application.

Reproduction

To reproduce this vulnerability, send a POST request to the login endpoint with a crafted username that includes SQL injection payloads, such as 'admin' followed by a SQL comment indicator. This injection exploits the application's SQL query handling, bypassing authentication and granting access as an administrator.